Feature Request : LuCI package manager, option to --no-check-certificate in case of certificate failure

[shodanx]

Hi,

I've just woken up an old router of mine, went to update the package list and got the following

Now, from the user's point of view it is not clear what is going on, does the router have DNS, can it even ping the internet ?

For typical user this means openwrt is now broken and needs re-flash

So, I poped the hood and

So here at minimum the package manager should investigate what it can
Let the user know the certificate are failing, especially which certificates, the expiration dates on those certificates and show current system time to the user.

Also, if the remote website is reachable, present the user with the info of the remote site's certificate
At least name, address, organisation, certificate creation and expiration date, and finally, ask the user if the remote certificate should be accepted (after they've made sure they're not victim to a MitM attack). And if so, place the new certificate, in the keyring and accept as valid.

Anyway, at this point, not sure what is wrong. Found several posts with similar issues

SSL support in OpenWrt OPKG (wget)

Hi, I have been trying to enable SSL (for wget) in OpenWrt. As far as I understood OpenWrt comes with wget builtin, but without SSL support due to size constraints. I have followed several tutorials online, but don't seem to get support for SSL. In the beginning when running opkg update without --no-check-certificate. I got the following warning: wget: SSL support not available, please install one of the libustream-.*[ssl|tls] packages as well as the ca-bundle and ca-certificates packages. …

DDNS setup gone wrong OPKG Update Failed

I have a Luxul ABR-4500. I installed OpenWRT directly from the compatible device list. I got everything up and working. The internet is currently working fine and has been for months. System |Hostname|LuxulOpenWrt| |Model|Luxul ABR-4500 V1| |Architecture|ARMv7 Processor rev 0 (v7l)| |Target Platform|bcm53xx/generic| |Firmware Version|OpenWrt 22.03.3 r20028-43d71ad93e / LuCI openwrt-22.03 branch git-23.039.29681-007c243| |Kernel Version|5.10.161| |Local Time|2023-03-01 12:08:30| |Uptime…

[SOLVED] Cannot update OpenWrt

I cannot update or upgrade OpenWRT packages. I get the following error. I can ping and resolve hostnames just fine from the Dianostics section. Any ideas? Thanks Model Ubiquiti UniFi AC LR Architecture Qualcomm Atheros QCA956X ver 1 rev 0 Target Platform ath79/generic Firmware Version OpenWrt 22.03.2 r19803-9a599fee93 / LuCI openwrt-22.03 branch git-22.288.45147-96ec0cd Kernel Version 5.10.146 Executing package manager Downloading https://downloads.openwrt.org/releases/22.03.2/targets/ath79/…

Opkg --no-check-certificate update doesn't work

When was it last working? What changed between then and now?

Wget error:Connection error: Invalid SSL certificate

I changed openwrt opkg sources to a local mirror, but update fails. when test with wget in terminal, it shows ssl certificate error.why? wget https://mirrors.bfsu.edu.cn/openwrt/releases/21.02.0/targets/ath79/generic/packages/Pack ages.gz Downloading 'https://mirrors.bfsu.edu.cn/openwrt/releases/21.02.0/targets/ath79/generic/packages/Packages.gz' Connecting to 2001:da8:20f:4435:4adf:37ff:fe55:2840:443 Connection error: Invalid SSL certificate

Opkg update problem - Invalid SSL certificate (Letsencrypt global root cert expiration)

oooh...thank you for that tip!

First I managed to update with --no-check-certificate

opkg update --no-check-certificate

that worked, then I tried updating ca-bundle, strangely no output from that command

root@WAPN:~# opkg upgrade ca-bundle --no-check-certificate
root@WAPN:~#

Tested opkg update, still getting that error

Ok, upgrade everything

Ah, no, doesn't work that way

root@WAPN:~# opkg upgrade --no-check-certificate
opkg: the ``upgrade'' command requires at least one argument

Ok, let's get the list

root@WAPN:~# opkg list-upgradable
terminfo - 6.3-1 - 6.3-2
iwinfo - 2022-08-19-0dad3e66-1 - 2022-12-15-8d158096-1
luci-app-opkg - git-22.154.41881-28e92e3 - git-22.273.29004-9f6876b
rpcd - 2022-08-24-82904bd4-1 - 2022-12-15-7de4820c-1
busybox - 1.35.0-3 - 1.35.0-5
nano - 6.4-1 - 7.2-1
libiwinfo-lua - 2022-08-19-0dad3e66-1 - 2022-12-15-8d158096-1
luci-mod-system - git-22.140.66206-02913be - git-23.013.73113-588381e
libustream-wolfssl20201210 - 2022-01-16-868fd881-1 - 2022-12-08-9217ab46-2
ucode-mod-ubus - 2022-08-29-344fa9e6-1 - 2022-12-02-46d93c9c-1
luci-theme-bootstrap - git-22.141.59265-d8ecf48 - git-22.288.45147-96ec0cd
wpad-basic-wolfssl - 2022-01-16-cff80b4f-11 - 2022-01-16-cff80b4f-15.2
procd-ujail - 2022-06-01-7a009685-1 - 2022-06-01-7a009685-2
ucode-mod-uci - 2022-08-29-344fa9e6-1 - 2022-12-02-46d93c9c-1
firewall4 - 2022-09-01-f5fcdcf2-1 - 2022-10-18-7ae5e14b-1
dnsmasq - 2.86-14 - 2.86-15
procd - 2022-06-01-7a009685-1 - 2022-06-01-7a009685-2
px5g-wolfssl - 4 - 6.2
luci-mod-status - git-22.189.48501-6731190 - git-23.038.33313-b256644
ucode-mod-fs - 2022-08-29-344fa9e6-1 - 2022-12-02-46d93c9c-1
libnftnl11 - 1.2.1-1 - 1.2.1-2
rpcd-mod-file - 2022-08-24-82904bd4-1 - 2022-12-15-7de4820c-1
odhcpd-ipv6only - 2022-03-22-860ca900-1 - 2023-01-02-4a673e1c-2
procd-seccomp - 2022-06-01-7a009685-1 - 2022-06-01-7a009685-2
libiwinfo-data - 2022-08-19-0dad3e66-1 - 2022-12-15-8d158096-1
ucode - 2022-08-29-344fa9e6-1 - 2022-12-02-46d93c9c-1
luci-base - git-22.245.77528-487e58a - git-23.069.50944-cd8bea9
libncurses6 - 6.3-1 - 6.3-2
libiwinfo20210430 - 2022-08-19-0dad3e66-1 - 2022-12-15-8d158096-1
uhttpd - 2022-08-12-e3395cd9-1 - 2022-10-31-23977554-1
libucode20220812 - 2022-08-29-344fa9e6-1 - 2022-12-02-46d93c9c-1
rpcd-mod-iwinfo - 2022-08-24-82904bd4-1 - 2022-12-15-7de4820c-1
luci-mod-network - git-22.244.54818-b13d8c7 - git-22.345.48602-4853e7b
uhttpd-mod-ubus - 2022-08-12-e3395cd9-1 - 2022-10-31-23977554-1
hostapd-common - 2022-01-16-cff80b4f-11 - 2022-01-16-cff80b4f-15.2
wireless-regdb - 2022.06.06-1 - 2022.08.12-1
root@WAPN:~#

Ok, let's upgrade the ones with ssl in the name

opkg upgrade libustream-wolfssl20201210 px5g-wolfssl wpad-basic-wolfssl --no-check-certificate

Oh, still doesn't work

root@WAPN:~# opkg update
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz

Ok, maybe it's time to wipe this router, I'm running out of ammo here ...

more search

Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

And note that you can also tell curl to not check the certificate.

https://forum.openwrt.org/t/opkg-update-problem-invalid-ssl-certificate-letsencrypt-global-root-cert-expiration/107895/12
https://forum.openwrt.org/t/opkg-uclient-fetch-cant-download-from-https-site-invalid-ssl-certificate-letsencrypt-global-root-cert-expiration/107891/22

A few more things to check

root@WAPN:~# wget http://www.google.com
Downloading 'http://www.google.com'
Connecting to 172.217.13.164:80
Writing to 'index.html'
Cannot open output file: File exists
root@WAPN:~# opkg list-installed | grep -E "wget|ssl|cert"
libustream-wolfssl20201210 - 2022-12-08-9217ab46-2
libwolfssl5.5.4.ee39414e - 5.5.4-stable-1
luci-ssl - git-20.244.36115-e10f954
px5g-wolfssl - 6.2
wpad-basic-wolfssl - 2022-01-16-cff80b4f-15.2
root@WAPN:~#

Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

Hi, At 2021-09-30 14:01:16 UTC, our openwrt devices using curl stopped working with the following error. % curl --cacert /etc/ssl/certs/ca-certificates.crt https://www.somedomain.com/ curl: (51) Cert verify failed: BADCERT_EXPIRED We logged into one of the devices and updated the ca-certificates package but no change. Does anyone know what's going on? We didn't make any changes and certs are valid on the sites we've tested against.

OpenWrt 21.02 install openssl (to replace wolfssl)

Note that if you have enough flash space, you can leave wolfssl library there, you just add the openssl library, and then provide correct variants of each app that uses SSL. For some OpenWrt core apps (like uhttpd, uclient-fetch/wget, etc.) the SSL library is hidden behind the ustreamssl library, which converts the generic SSL calls to calls specific to each SSL library variant. so the SSL lib can be changed easily. You should be able to install libopenssl install openssl-util then remove li…

Something's wrong about wolfssl ?

root@WAPN:~# opkg install libopenssl openssl-util --no-check-certificate
Installing libopenssl1.1 (1.1.1t-1) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/libopenssl1.1_1.1.1t-1_mips_24kc.ipk
Installing openssl-util (1.1.1t-1) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/openssl-util_1.1.1t-1_mips_24kc.ipk
Installing libopenssl-conf (1.1.1t-1) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/libopenssl-conf_1.1.1t-1_mips_24kc.ipk
Configuring libopenssl1.1.
Configuring libopenssl-conf.
Generating engines.cnf
Configuring openssl-util.
root@WAPN:~# opkg remove libustream-wolfssl
No packages removed.
root@WAPN:~# opkg remove libustream-wolfssl20201210
No packages removed.
Collected errors:
 * print_dependents_warning: Package libustream-wolfssl20201210 is depended upon by packages:
 * print_dependents_warning:    luci-ssl
 * print_dependents_warning: These might cease to work if package libustream-wolfssl20201210 is removed.

 * print_dependents_warning: Force removal of this package with --force-depends.
 * print_dependents_warning: Force removal of this package and its dependents
 * print_dependents_warning: with --force-removal-of-dependent-packages.
root@WAPN:~# opkg remove libustream-wolfssl20201210 --force-depends
Removing package libustream-wolfssl20201210 from root...
root@WAPN:~# opkg install libustream-openssl --no-check-certificate
Installing libustream-openssl20201210 (2022-12-08-9217ab46-2) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk
wget: SSL support not available, please install one of the libustream-.*[ssl|tls] packages as well as the ca-bundle and ca-certificates packages.
Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk, wget returned 1.
 * opkg_install_pkg: Failed to download libustream-openssl20201210. Perhaps you need to run 'opkg update'?
 * opkg_install_cmd: Cannot install package libustream-openssl.

root@WAPN:~# opkg update --no-check-certificat
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz
wget: SSL support not available, please install one of the libustream-.*[ssl|tls] packages as well as the ca-bundle and ca-certificates packages.
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz

Uh oh ....

How to install libustream-ssl and libustream-tls

thank you very much!!

Well, this wasn't supposed to be a support thread, I thought this was going to be a minor annoyance for me and a road block for newbies. This was supposed to just bring attention to the fact that the ssl certificate system need to have minimal amount of self-diagnostic and self-healing capabilities because it is so essential to the proper functionning of the rest of the system.

Well now it is 04h40, I have been at this for hours and still broken.

I won't give up and wipe the firmware until I come back here and post a real solution...... Well .... probably

[shodanx]

Time for some AI help, I'm very tired

Ok but,

Lucky I had more linux computers just laying around, this router didn'thave SFTP support installed :\ no winscp

root@WAPN:~# scp barrier@barrierbuild.lan:/home/barrier/*.ipk ./
barrier@barrierbuild.lan's password:
libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk 100% 5238 5.1KB/s 00:00
root@WAPN:~#

root@WAPN:~# mkdir /var/cache
root@WAPN:~# mkdir /var/cache/opkg
root@WAPN:~# mv libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk /var/cache/opkg/
root@WAPN:~# opkg install --cache /var/cache/opkg/libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk
opkg: the ``install'' command requires at least one argument

Ok it didn't quite get it right

root@WAPN:~# opkg install --cache /var/cache/opkg/ libustream-openssl20201210
Installing libustream-openssl20201210 (2022-12-08-9217ab46-2) to root...
Copying /var/cache/opkg//libustream-openssl20201210_2022-12-08-9217ab46-2_mips_24kc.ipk.
Configuring libustream-openssl20201210.
root@WAPN:~#

and now the real test

root@WAPN:~# opkg update
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/Packages.gz

Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/luci/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/luci/Packages.gz

Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/routing/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/routing/Packages.gz

Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/telephony/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/telephony/Packages.gz

Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/luci/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/routing/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/telephony/Packages.gz, wget returned 5.

Now if you'll excuse me, I'll go pull my hairs out

[shodanx]

Ok, did the turn it off and on again trick

guess what

root@WAPN:~# opkg update
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ath79/generic/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/base/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/luci/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/routing/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading https://downloads.openwrt.org/releases/22.03.0/packages/mips_24kc/telephony/Packages.sig
Signature check passed.

So not sure at what step I fixed it, my advice would be to pre-download all the packages before removing libustream-wolfssl20201210

So, just run

opkg download libustream-openssl --no-check-certificate

[psherman]

MODERATOR NOTE:

I've moved this to the "installing and using OpenWrt" section of the forum because it is not clear what the request is here. It's just too difficult to read and seems more like a troubleshooting post.

A feature request should be simple to understand -- what is the "ask" and the proposed solution to be implemented. This existing post may be good as context if you believe it explains the details of why you're making the FR, and you can simply link to it from the concise feature request thread.

[shodanx]

No problem,
It started as a feature request for more explicit error messages regarding the package manager

I figured it would be a one command fix but I kept documenting the process.

Until it balooned into a multi hour tech nightmare.

So I will take that and break it down into concise feature requests to avoid this problem happening again. Or at least, make it easier on the user to recover.

At least easier than re-flashing from scratch !